US8615650B2 - Control-word deciphering, transmission and reception methods, recording medium and server for these methods - Google Patents

Control-word deciphering, transmission and reception methods, recording medium and server for these methods Download PDF

Info

Publication number
US8615650B2
US8615650B2 US13/519,661 US201013519661A US8615650B2 US 8615650 B2 US8615650 B2 US 8615650B2 US 201013519661 A US201013519661 A US 201013519661A US 8615650 B2 US8615650 B2 US 8615650B2
Authority
US
United States
Prior art keywords
control
terminal
word
server
channel
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related
Application number
US13/519,661
Other versions
US20120290831A1 (en
Inventor
Erwann Magis
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Viaccess SAS
Original Assignee
Viaccess SAS
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Viaccess SAS filed Critical Viaccess SAS
Assigned to VIACCESS reassignment VIACCESS ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: MAGIS, ERWANN
Publication of US20120290831A1 publication Critical patent/US20120290831A1/en
Assigned to VIACCESS reassignment VIACCESS CORRECTIVE ASSIGNMENT TO CORRECT THE ASSIGNMENT RECORDED UNDER THE WRONG APPLICATION NO., US 13/359,661. PLEASE CORRECT THE APPLICATION NUMBER TO READ "13519661" PREVIOUSLY RECORDED ON REEL 028460 FRAME 0871. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT. Assignors: MAGIS, ERWANN
Application granted granted Critical
Publication of US8615650B2 publication Critical patent/US8615650B2/en
Expired - Fee Related legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
    • H04N21/45—Management operations performed by the client for facilitating the reception of or the interaction with the content or administrating data related to the end-user or to the client device itself, e.g. learning user preferences for recommending movies, resolving scheduling conflicts
    • H04N21/462—Content or additional data management, e.g. creating a master electronic program guide from data received from the Internet and a Head-end, controlling the complexity of a video stream by scaling the resolution or bit-rate based on the client capabilities
    • H04N21/4623—Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/60—Network structure or processes for video distribution between server and client or between remote clients; Control signalling between clients, server and network components; Transmission of management data between server and client, e.g. sending from server to client commands for recording incoming content stream; Communication details between server and client 
    • H04N21/63—Control signaling related to video distribution between client, server and network components; Network processes for video distribution between server and clients or between remote clients, e.g. transmitting basic layer and enhancement layers over different transmission paths, setting up a peer-to-peer communication via Internet between remote STB's; Communication protocols; Addressing
    • H04N21/633—Control signals issued by server directed to the network components or client
    • H04N21/6332—Control signals issued by server directed to the network components or client directed to client
    • H04N21/6334—Control signals issued by server directed to the network components or client directed to client for authorisation, e.g. by transmitting a key
    • H04N21/63345—Control signals issued by server directed to the network components or client directed to client for authorisation, e.g. by transmitting a key by transmitting keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/60—Digital content management, e.g. content distribution
    • H04L2209/601—Broadcast encryption

Definitions

  • the invention pertains to methods for enciphering, transmitting and receiving control words.
  • the invention also pertains to an information-recording medium and to a control-word server to implement these methods.
  • multimedia content designates an audio and/or visual content designed to be rendered in a form directly perceptible and comprehensible to a human being.
  • a multimedia content corresponds to a succession of images forming a film, a television show or advertising material.
  • a multimedia content can also be an interactive content such as a game.
  • each item of multimedia content is broadcast on its own channel.
  • the channel used to transmit a multimedia content is also known as a “station”.
  • a channel typically corresponds to a television station. This enables the user to choose simply the multimedia content that he wishes to view in changing channels.
  • the multimedia contents are broadcast in scrambled form and not in plain or unencrypted form. More specifically, each multimedia content is divided into a sequence of cryptoperiods. Throughout the duration of a cryptoperiod, the conditions of access to the scrambled multimedia content remain unchanged. In particular, throughout the duration of a cryptoperiod, the multimedia content is scrambled with the same control word. Generally, the control word varies from one cryptoperiod to another. Furthermore, the control ward is generally specific to a multimedia content. Thus if, at a given instant, N multimedia contents are broadcast simultaneously on N channels, then there are N different control words each used to scramble one of these multimedia contents.
  • the plain or unencrypted multimedia content corresponds to the multimedia content before it is scrambled.
  • This content can be made directly comprehensible to a human being without recourse to descrambling operations and without placing conditions on the viewing of this content.
  • control words needed to descramble the multimedia contents are transmitted synchronizedly with the multimedia contents.
  • the control words needed to descramble the (t+1) th cryptoperiod are received by each terminal during the t th cryptoperiod.
  • the control words are multiplexed with the scrambled multimedia content.
  • these words are transmitted to the terminals in the form of cryptograms.
  • the term “cryptogram” herein designates a piece of information that is not sufficient by itself to retrieve the control word in plain form. Thus, if the transmission of the control word is intercepted, knowledge of the control word cryptogram alone does not make it possible to retrieve the control word by which the multimedia content can be descrambled.
  • the plain control word i.e. the control word used to directly descramble the multimedia content
  • it must be combined with a piece of secret information.
  • the cryptogram of the control word is obtained by enciphering the plain control word with a cryptographic key.
  • the secret information is the cryptographic key used to decipher this cryptogram.
  • the cryptogram of the control word can also be a reference to a control word stored in a table containing a multitude of possible control words. In this case, the secret information is the table associating a plain control word with each reference.
  • the secret information should be kept in a secure place. To this end, it has already been proposed to store the secret information:
  • terminals are devoid of chip cards. These terminals are then called cardless terminals.
  • the control-word server is connected to each of the terminals by a long-distance information-transmission network such as the Internet.
  • a control-word server When a control-word server is used, the cryptograms of the control words are first of all transmitted to the different terminals and then forwarded by these terminals to the control-word server.
  • the information-transmission network used to broadcast the multimedia contents and the cryptograms of the control words can be different from the one used to connect the terminals to the control-word server.
  • the network for broadcasting multimedia content and cryptograms of the control words is a one-way network with a large bandwidth, for example a satellite network.
  • the network connecting the terminals to the control-word server is a two-way network with a bandwidth that may be smaller.
  • the control-word server has the function of deciphering the cryptograms of the control words transmitted by the terminals and then sending the deciphered control word back to each of these terminals.
  • the control-word server plays the role of a chip card common to several terminals that are mechanically and electrically independent of one another.
  • Terminals that are electronically independent of one another are terminals that can work autonomously and have no electronic part common to them,
  • a terminal When a terminal needs a control word to descramble a multimedia content, it sends the control-word server a request containing the cryptogram of the control word. In response, the control-word server deciphers this cryptogram and then sends the deciphered control word to the terminal which can then descramble the desired multimedia content.
  • the multimedia contents broadcast over the different channels are temporally coordinated with one another.
  • the multimedia content broadcasting times are set so as to comply with the broadcasting times indicated in a pre-established program schedule.
  • Each terminal on a given channel therefore receives appreciably the same multimedia content at the same time.
  • each terminal In response to this change of channel, each terminal immediately transmits a request to the control-word server and, in response, receives the control word needed to descramble of the multimedia content currently being broadcast on the new channel being viewed.
  • a massive and simultaneous change from one channel to another will cause a peak in the workload of the control-word server.
  • the computation power of the control-word server depends on this load peak.
  • the greater the load peak i.e. the greater the maximum number of requests to be processed in a predetermined time span, the greater is the computation power needed by the control-word server.
  • the invention seeks to limit these load peaks of the control-word server.
  • An object of the invention therefore, is a method for deciphering control words wherein.
  • the first terminal has advance possession of the control word CW 2,t needed to descramble the multimedia contents simultaneously broadcast on the second channel.
  • the control-word server it is not necessary for the first terminal to immediately transmit a request to the control-word server to be given the control word CW 2,t .
  • the load peaks of the control-word server are therefore reduced by preventing the systematic and immediate transmission of a large number of simultaneous requests to this control-word server in response to a channel change.
  • the first terminal does not need to transmit the cryptogram CW* 2,t to the control-word server before the change in channel. This method is therefore simple to implement and minimizes the modifications to be made to the terminal
  • This method also reduces the waiting time before the multimedia content broadcast on the second channel can be descrambled. Indeed, the terminal does not have to immediately send a request to the control-word server and then wait for the control word CW 2,t if it has already been transmitted in advance.
  • An object of the invention is also a method for transmitting control words CW 1,t and CW 2,t to first and second terminals that are mechanically and electronically independent of one another, wherein:
  • An abject of the invention is also a method for the reception of control words CW 1,t and CW 2,t by a first terminal wherein:
  • An object of the invention is also an information-recording medium comprising instructions to implement one of the above methods, when these instructions are executed by an electronic computer.
  • control-word server this server being capable:
  • FIG. 1 is a schematic illustration of a system for broadcasting scrambled multimedia contents
  • FIG. 2 is a schematic illustration of a control word table used in the system of FIG. 1 ,
  • FIG. 3 is a flowchart of a method for transmitting scrambled multimedia contents by means of the system of FIG. 1 ,
  • FIG. 4 is a flowchart of another method for transmitting scrambled multimedia contents by means of the system of FIG. 1 .
  • FIG. 5 is a schematic illustration of another embodiment of a table of control words used in combination with the method of FIG. 4 .
  • FIG. 1 represents a system 2 for sending and receiving multimedia contents.
  • a multimedia content corresponds for example to a sequence of an audio/visual program such as a television broadcast or a film.
  • Plain multimedia contents are generated by one or more sources 4 and transmitted to a device 6 for simultaneous broadcasting to a multitude of reception devices through an information-transmission network 8 .
  • the multimedia contents broadcast are time-synchronized with one another so as for example to comply with a pre-established program schedule.
  • the network 8 is typically a long-distance information-transmission network such as the Internet or a satellite network or any other broadcasting network such as the one used to transmit digital terrestrial television (DTTV).
  • DTTV digital terrestrial television
  • FIG. 1 To simplify FIG. 1 , only three reception devices 10 to 12 are shown.
  • the device 6 includes an encoder 16 which compresses the multimedia contents that it receives.
  • the encoder 16 processes digital multimedia contents.
  • this encoder works in compliance with the MPEG2 (Moving Picture Expert Group-2) standard or the UIT-T H264,
  • the compressed multimedia contents are directed towards an input 20 of a scrambler 22 .
  • the scrambler 22 scrambles each compressed multimedia content to make its viewing conditional on certain terms such as the purchase of an access entitlement by the users of the reception devices.
  • the scrambled multimedia contents are rendered at an output 24 connected to the input of a multiplexer 26 .
  • the scrambler 22 scrambles each compressed multimedia content by means of a control word CW i,t that is given to it as well as to a conditional access system 28 or CAS by a key generator 32 .
  • the index i is an identifier of the channel on which the scrambled multimedia content is broadcast and the index t is an identifier of the cryptoperiod scrambled with this control word.
  • this scrambling is compliant with a standard such as the DVB-CSA (Digital Video Broadcasting—Common Scrambling Algorithm), ISMA Cryp (Internet Streaming Media Alliance Cryp), IPsec (Internet Protocol Security Keying Information Resource Record Working Group), SRTP (Secure Real-time Transport Protocol), or other such standards.
  • DVB-CSA Digital Video Broadcasting—Common Scrambling Algorithm
  • ISMA Cryp Internet Streaming Media Alliance Cryp
  • IPsec Internet Protocol Security Keying Information Resource Record Working Group
  • SRTP Secure Real-time Transport Protocol
  • the system 28 generates ECM (Entitlement Control Messages) containing at least the cryptogram CW* i,t of the control word CW i,t generated by the generator 32 and used by the scrambler 22 for each cryptoperiod of each multimedia content.
  • ECM Entitlement Control Messages
  • These messages and the scrambled multimedia contents are multiplexed by the multiplexer 26 , these scrambled multimedia contents being respectively given by the conditional access system 28 and the scrambler 22 and then transmitted on the network 8 .
  • the system 28 also inserts the following in each ECM:
  • the same identifier is inserted in all the ECM messages containing a cryptogram CW* i,t for the descrambling of the multimedia content broadcast on a same channel.
  • the scrambling and the multiplexing of the multimedia content is compliant with the DVB-Simulcrypt protocol.
  • the identifier i may correspond to a unique “channel ID/stream ID” pair on which are sent all the requests for the generation of ECM messages for this channel.
  • terminals 10 to 12 are identical and only the terminal 10 is described in greater detail.
  • the reception device 10 includes a receiver 70 of broadcast multimedia contents.
  • This receiver 70 is connected to the input of a demultiplexer 72 which transmits on the one hand the multimedia content to a descrambler 74 and on the other hand the ECM and EMM (Entitlement Management Message) messages to a processor 76 .
  • the processor 76 processes confidential information such as cryptographic keys. In order that the confidentiality of this information may be preserved, it is designed to be as robust as possible against attempted attacks by computer hackers. It is therefore more robust against these attacks than the other components of the device 10 . This robustness is obtained for example by implementing a software module dedicated to the protection of secret information.
  • the processor 76 is made for example by means of programmable electronic computers capable of executing instructions recorded on an information-recording medium. To this end, the processor 76 is connected to a memory 78 containing the instructions needed to execute the methods of FIG. 3 or 4 .
  • the memory 78 also contains:
  • the descrambler 74 descrambles the scrambled multimedia content using the control word transmitted by the processor 76 .
  • the descrambled multimedia content is transmitted to a decoder 80 which decodes it.
  • the decompressed or decoded multimedia content is transmitted to a graphic card 82 which drives the display of this multimedia content on a display unit 84 equipped with a screen 86 .
  • the display unit 84 provides a plain display of the multimedia content on the screen 86 .
  • the terminal 10 also has a sender 88 used to set up a secured connection with a network tunnel endpoint 90 by means of an information-transmission network 92 .
  • the network 92 is a long-distance information-transmission network and more specifically a packet-switching network such as the Internet.
  • the secured connection is for example a secured tunnel
  • the network tunnel endpoint 90 has a module 100 for managing the access entitlements of the different users of the system 2 .
  • This module 100 is better known as a “subscriber authorization system”
  • This module 100 generates a database 102 and keeps it up to date. With each user identifier, the database 102 associates the access entitlements acquired by this user. This database 102 is stored in a memory 104 .
  • the tunnel end point 90 also has a server 1038 of control words connected to an access-right checking module 108 and a memory 110 containing a table 112 of control words.
  • the server 106 is made out of programmable electronic computers capable of executing instructions recorded in an information-recording medium.
  • the memory 110 also has instructions to execute the method of FIG. 3 or 4 .
  • Each row of the table 112 corresponds to a recording.
  • the table 112 has several recordings. Each recording corresponds to an ECM message. Each of these recordings contains the following fields:
  • the structure of the table 79 is for example identical to the structure of the table 112 .
  • the device 6 broadcasts several different multimedia contents simultaneously on different channels.
  • the cryptoperiod t and the next cryptoperiod t+1 are scrambled with the control words, CW i,t and CW i,t+1 .
  • the ECM messages containing the cryptograms CW* i,t and CW i,t+1 of the control words CW i,t and CW i,t+1 are multiplexed with the broadcast multimedia contents. This multiplexing synchronizes the broadcasting of the control words with the broadcasting of the multimedia contents.
  • the ECM messages are repeated several times within a same cryptoperiod. For example, the ECM messages are repeated every 0.1 second to 0.5 seconds.
  • the duration of a cryptoperiod is greater than 10 seconds and preferably greater than 5 or 10 minutes in order to further limit pressure on the control-word servers.
  • the scrambled multimedia contents are received appreciably at the same time by each of the terminals 10 to 12 .
  • the following steps are therefore executed appreciably in parallel for each of these terminals. It is also assumed that the different terminals simultaneously descramble a multimedia content each, broadcast on a respective channel. The next steps are described in the particular case of the terminal 10 .
  • the scrambled multimedia contents with ECM messages are received by the receiver 70 .
  • the demultiplexer 72 extracts the scrambled multimedia content corresponding to the channel i for which the descrambling is currently being requested by the user.
  • the demultiplexer 72 also extracts solely the ECM messages containing the cryptograms of the control words to descramble this same channel.
  • the demultiplexer 72 transmits the extracted multimedia content to the descrambler 74 .
  • the extracted ECM messages for their part are transmitted to the processor 76 .
  • the processor 76 the processor 76 :
  • control words found in the table 79 are valid, then the terminal proceeds to a phase 127 for descrambling the multimedia content broadcast on the channel i.
  • the processor 76 sends the descrambler 74 the control words CW i,t and CW i,t+1 associated with this MAC signature in the table 79 . No request to decipher the cryptograms CW* i,t and CW* i,t+1 is immediately transmitted to the server 106 .
  • the descrambler at a step 130 descrambles the multimedia content received through this pair of control words CW i,t /CW i,t+1 .
  • the descrambled multimedia content is decoded by the decoder 80 and then transmitted to the video card 82 .
  • the video card 82 transmits the video signal to the display device 84 so that the multimedia content gets displayed on the screen 86 in a way that is directly perceptible and comprehensible to a human being.
  • the processor 76 performs a step 138 during which it checks to see if the user has changed channels. For example, it compares the channel identifier contained in the received ECM received with the channel identifier contained in the previous received ECM message.
  • the terminal 10 immediately sends a request to the server 106 to decipher the cryptograms CW* i,t and CW* i,t+1 contained in the ECM message received.
  • This request contains the ECM message received and therefore the pair of cryptograms CW* i,t /CW* i,t+1 as well as an identifier of the user of the terminal that has sent the request.
  • This request is transmitted to the server 106 through the sender 88 and the network 92 . All these exchanges of information between the terminal and the server 106 are done by means of a secured tunnel set up through the network 92 .
  • the setting up of the tunnel calls for the authentication and identification of the terminal by the server 106 , for example using the cryptographic certificate contained in the memory 78 .
  • the processor 76 delays the transmission of this request. To this end, the processor 76 determines a period of waiting before activating the sending of the request to the server 106 . This waiting period is determined so as to smoothen the instants at which these requests are sent by different terminals having received this new ECM message at the same time. The waiting time is however chosen systematically to be short enough to enable the reception of the pair of control words CW i,t /CW i,t+2 deciphered before the end of the cryptoperiod t. For example, at the step 142 , the processor 76 randomly or pseudo-randomly draws a number and, depending on this random number, determines the duration of the waiting to be applied. After the waiting duration, the result is sent to the server 106 .
  • This temporal smoothing of the instants at which the request is sent to the server 106 by different terminals using the same control-word server limits the appearance of load peaks. In particular, this prevents a situation of having a load peak in response to each first broadcast of a new ECM.
  • the server 106 responds as quickly as possible to the request sent at the end of the step 140 or 142 .
  • the server 106 selects recordings in the table 112 to build a new local table for this terminal.
  • the module 108 extracts, from the base 102 , the access entitlements corresponding to the user identifier contained in the request.
  • the server 106 selects, in the table 112 , only the control words associated with access rights DA corresponding to access to the extracted access entitlements.
  • this local table is limited to the N pairs of control words corresponding to the N channels to which it is most probable that the user will be zapping, where N is an integer greater than 1 and preferably greater than 2 or 10.
  • the server 106 builds and uses indices P i associated with each channel i. These indices P, represent the probability that the user will change to the channel i.
  • the index P is the value of a counter C i .
  • a counter C i counts the number of times when a request to decipher a pair of control words CW i,t /CW i,t+1 has been received by the server 106 during a sliding window.
  • the duration S 1 of the sliding window is greater than at least one cryptoperiod and preferably greater than several cryptoperiods. For example, the duration S 1 ranges from 30 seconds to five minutes.
  • the counter C i is incremented by a step whatever the terminal that has sent a request to obtain a control word enabling the channel to be descrambled.
  • the value of the counter C i is therefore equal to the number of times in which, during the period S 1 the server 106 has received a request to decipher a control word necessary for the descrambling of this channel.
  • the value of the counter C i is all the greater as the number of terminals descrambling the channel i is great.
  • the value of the counter C i therefore indicates the channels that are most requested by the users. In this embodiment, it is considered that the more the channel i is in demand, the more probable it is that a channel will change its current channel to descramble the channel i.
  • the counter C is stored in the memory 110 .
  • the server 106 makes a check to see if the ECM contained in the request of the terminal 10 has already been received. For example, to this end, it compares the MAC signature of the ECM received with the MAC signatures contained in the table 112 .
  • the server 106 If the MAC signature is not already in the table 112 , it means that this ECM is received for the first time by the server 106 .
  • the server 106 then carries out a phase 150 of updating the table 112 .
  • This phase starts with a step 150 during which the server 106 deciphers the pair of cryptograms CW* i,t /CW* i,t+1 contained in the ECM received.
  • This new recording contains:
  • the phase 150 also comprises a step 154 for managing the sliding window during which the server checks to see if the difference between the current instant t c and the reception instant t recept of a recording in the table 112 does not exceed the duration S 1 . If the answer is yes, the corresponding recording is erased from the table 112 . At the same time, the counter C i associated with the identifier of the erased recording is decremented by one step. Should the threshold S 1 not be crossed, the recording is not erased and remains contained in the table 112 .
  • the step 115 is reiterated at regular intervals so as to erase those recordings from the table 112 that have become obsolete.
  • the server 106 performs a step 160 during which it increments the counter C i associated with the identifier i contained in the processed ECM.
  • the server 106 checks to see if the access rights contained in the received ECM message correspond to the access entitlements of the user who has transmitted this ECM message. If the answer is yes, and if the local table of the control words built during the step 146 does not already contain the pair CW i,t /CW i,t+1 , the recording created from the received ECM is added to this local table.
  • the server 106 sends the terminal 10 , in response to its request, the local table built by the server 106 .
  • This new local table received by the terminal then replaces the table 79 previously used by the terminal 10 .
  • the terminal immediately sends a request to the server 106 to obtain the pair CW i,t+1 /CW i,t+2 .
  • the MAC signature of the ECM message containing the pair CW i,t+1 /CW i,t+2 is not the same as that of the ECM message containing the pair CW i,t /CW i,t+1 . It may be desirable to have available a method similar to that of FIG. 3 but enabling the terminal to exploit the control word CW i,t+1 contained in the local table 79 to start immediately descrambling the multimedia content broadcast on the channel i without having to immediately send a request to the server 106 .
  • the method of FIG. 4 furthermore makes it possible to comply with this requirement.
  • an order number N ECMi is inserted in each message ECM i,t to identify the message ECM i,t preceding the message ECM i,t+1 .
  • the number N ECMi is inserted into each ECM message by the device 6 .
  • the structure of the tables 79 and 112 is modified to correspond to that of the table 200 ( FIG. 5 ).
  • the table 200 is identical to the table 112 except for the fact that, for each recording, it has an additional field N ECMi corresponding to the order number of the ECM message associated with a particular channel i.
  • each counter C i is replaced by counters C ij , where the index i is an identifier of the channel and the index j is an identifier of the user of the terminal.
  • Each counter C ij counts the number of times where the user j has sent a request to descramble the channel during the sliding window of a duration S 1 . This counter is therefore not modified by the information contained in requests coming from other terminals than that used by the user j.
  • each of these counters C ij is therefore an index P ij representing the probability that the user changes channels to pass to this channel i.
  • the selection of the control words incorporated into the local table built by the server 106 for this user j is done as a function of the index P ij . This adapts the building of the local table for the user j according to his past behavior.
  • the method of FIG. 4 is identical to the method of FIG. 3 except that the step 126 and the phases 127 and 144 are replaced respectively by the step 178 and the phases 179 and 192 .
  • the processor 76 checks to see whether a valid control word required to descramble the broadcast multimedia content is already present in the table 79 . To this end, the duration of validity DV associated with the identifier i in the table 79 is compared with the current instant t c . Furthermore, the processor 76 also checks to see whether the order number N ECMi contained in the ECM message received is equal to the order number N ECMi associated with the identifier i in the table 79 or with the previous order number.
  • the processor 76 proceeds to the phase 179 for descrambling the multimedia content broadcast on the channel 1 .
  • This phase 179 is identical to the phase 127 except that the step 128 is replaced by a step 182 .
  • This step 182 is identical to the step 128 but in addition to the operations described here above, the processor 76 sends the descrambler 74 the pair of control words CW i,t+1 /CW i,t if the order number N ECMi contained in the table 79 is equal to the received order number N ECMi ⁇ 1.
  • the phase 192 is identical to the phase 144 except that the steps 146 , 160 and 162 are replaced by steps 194 , 196 and 198 .
  • the step 194 is identical to the step 146 except that it is only the indices P ij associated with the user j that are used to select the recordings to be included in the local table built by the server 106 .
  • the step 196 is identical to the 160 except that only the counter C ij specific to the user j and to the channel i is incremented whenever a new request to descramble this channel is received by the server 106 .
  • the phase 150 is also replaced by a phase 197 identical to the phase 150 except that this phase 154 is replaced by another step 198 for managing the sliding window.
  • the step 198 all the counters C ij associated with the channel i of the erased recording are decremented at the same time. Consequently, the duration S 1 can be far greater than in the case of the method of FIG. 3 .
  • the duration S 1 ranges from one to four weeks.
  • the method of FIG. 4 has several advantages. In particular, it can be used to descramble a new channel without immediately transmitting a new request to the server 106 provided that one of the two control words of a pair of control words can validly be used to descramble this channel.
  • the local table of control words is built by combining the teachings given with reference to FIGS. 3 and 4 .
  • the local table is built by the server 106 by selecting recordings as a function of both the indices P and P.
  • At least some of the recordings to be selected are identified manually by the user of the terminal 10 .
  • the user of the terminal 10 interacts with the terminal to acquire a list of channel identifiers between which the user wishes to navigate rapidly. This list is transmitted to the server 106 which records it. Then, whenever an ECM message is transmitted by this terminal, the recordings corresponding to the channels referenced in the list are systematically incorporated into the local table of control words built by the server 106 .
  • Indices of probabilities other than those described here above can be used to select the recordings to be incorporated into the local table.
  • the index can also depend on the initial channel descrambled before the channel is changed.
  • the set of control words contained in the table 112 and corresponding to the access entitlements of the user are sent to the terminal in response to each request from this terminal.
  • the different counters or indices enabling the selection of a limited number of recordings among all the recordings contained in the table 112 are omitted.
  • the channel identifier incorporated into the ECM message can be generated by the terminal itself and incorporated solely into the request transmitted to the control-word server. In this case, it is not necessary for this channel identifier to be incorporated into the ECM messages built by the system 28 .
  • the updating of the table 79 is not necessarily activated by the reception of a new ECM message for the currently requested channel.
  • a request for updating the table 79 is automatically sent to the server 106 by the terminal immediately upon expiry of the duration of validity of the control words contained in this table for one or more channels, even if the channels are not currently descrambled.
  • the sending of a request for updating the table 79 can also be activated as soon as the number of control words for which the duration of validity has expired exceeds a predetermined threshold.
  • this threshold is expressed as a percentage of a total number of control words contained in the table 79 .
  • these requests for updating the table 79 are smoothened in time so as not to prompt load peaks on the server 106 .
  • each cryptogram CW* i,t contained in an ECM message transmitted to the server 106 is done solely if the access rights contained in this same ECM correspond to the access entitlements of the user who has sent this ECM.
  • each request transmitted by a terminal to the server 106 also contains an image of the control words currently contained in the table 79 .
  • this image is constituted by the identifier i of the channel associated with the order number N ECMi in the table 79 .
  • the server 106 identifies only the recording or recordings for which an updating is necessary and transmits only these recordings during the step 162 . This limits the bandwidth needed to send local tables through the server 106 .
  • each pair of control words is enciphered by the server 106 with a private key K 1 known only to the terminal to which this pair of control words must be transmitted.
  • the control word table transmitted to the terminal then contains only the cryptograms E K1 (CW i,t ) thus obtained.
  • the other pieces of information of the local table can be non-enciphered. Consequently, the pairs of control words stored in the terminal are stored solely in enciphered form. The deciphering of these pairs of control words takes place only when the descrambling of the corresponding channel is activated. This increases security.
  • the device 6 carries out a first encipherment of the control words in plain form with a key K 1 and then a second encipherment with a key K 2 .
  • the ECM messages then contain the cryptogram E K2K1 (CW i,t ) instead of the cryptogram CW* i,t .
  • the server 106 deciphers the cryptogram E K2K1 (CW i,t ) for a first time with the key K 2 to obtain the control word E K1 (CW i,t ).
  • This control word E K1 (CW i,t ) is transmitted in response to the terminal.
  • the control word E K1 (CW i,t ) enables the descrambling of the multimedia content after it has been deciphered a second time by the terminal with the key K 1 .
  • the smoothening of the load peaks is all the more efficient as the duration of the cryptoperiods is long.
  • this method has the advantage of enabling a comparison of the access rights with the access entitlement of the user during each cryptoperiod.
  • An identifier of the terminal can be used in place of the user identifier.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Multimedia (AREA)
  • Software Systems (AREA)
  • Databases & Information Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Technology Law (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Two-Way Televisions, Distribution Of Moving Picture Or The Like (AREA)
  • Storage Device Security (AREA)

Abstract

A method for deciphering control words for mechanically and electronically independent terminals includes causing first and second terminals to transmit a first and second cryptograms to a control-word server, causing that server to decipher them to obtain first and second control words for enabling descrambling of first and second multimedia content broadcast simultaneously on respective first and second channels, causing the server to transmit the control word to the respective terminals, the second control word obtained by deciphering the second cryptogram before the first terminal executes a channel change, and in response to the channel change, causing the first terminal to search to determine whether the second control word has already been transmitted in advance by the server before the channel change, and if the control word has been transmitted in advance, causing the first terminal to immediately start descrambling the second multimedia content with the second control word.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS
This application is the National Stage of International Application No. PCT/EP2010/070318, filed Dec. 20, 2010, which claims the benefit of the priority date of French Patent Application No. 0959612 filed Dec. 28, 2009. The content of these applications is hereby incorporated by reference in its entirety.
FIELD OF THE INVENTION
The invention pertains to methods for enciphering, transmitting and receiving control words. The invention also pertains to an information-recording medium and to a control-word server to implement these methods.
BACKGROUND
There are methods for deciphering control words for a first terminal and at least one second terminal that are mechanically and electronically independent of one another, wherein:
    • the first and second terminals respectively transmit cryptograms CW*1,t and CW*2,t to a same control-word server,
    • in response the control-word server deciphers the cryptograms CW*1,t and CW*2,t to obtain respectively control words CW1,t and CW2,t, the control words CW1,t and CW2,t enabling the descrambling, respectively, of first and second multimedia contents broadcast simultaneously on first and second channels respectively, and then,
    • the control-word server transmits the control words CW1,t and CW2,t, respectively to the first and second terminals.
The term “multimedia content” designates an audio and/or visual content designed to be rendered in a form directly perceptible and comprehensible to a human being. Typically, a multimedia content corresponds to a succession of images forming a film, a television show or advertising material. A multimedia content can also be an interactive content such as a game.
There are known ways of broadcasting several multimedia contents at the same time. To this end, each item of multimedia content is broadcast on its own channel. The channel used to transmit a multimedia content is also known as a “station”. A channel typically corresponds to a television station. This enables the user to choose simply the multimedia content that he wishes to view in changing channels.
To secure and subject the viewing of multimedia contents to certain conditions, such as the payment of a subscription for example, the multimedia contents are broadcast in scrambled form and not in plain or unencrypted form. More specifically, each multimedia content is divided into a sequence of cryptoperiods. Throughout the duration of a cryptoperiod, the conditions of access to the scrambled multimedia content remain unchanged. In particular, throughout the duration of a cryptoperiod, the multimedia content is scrambled with the same control word. Generally, the control word varies from one cryptoperiod to another. Furthermore, the control ward is generally specific to a multimedia content. Thus if, at a given instant, N multimedia contents are broadcast simultaneously on N channels, then there are N different control words each used to scramble one of these multimedia contents.
Here, the terms “scramble” and “encipher” are considered to be synonyms.
The plain or unencrypted multimedia content corresponds to the multimedia content before it is scrambled. This content can be made directly comprehensible to a human being without recourse to descrambling operations and without placing conditions on the viewing of this content.
The control words needed to descramble the multimedia contents are transmitted synchronizedly with the multimedia contents. For example, the control words needed to descramble the (t+1)th cryptoperiod are received by each terminal during the tth cryptoperiod. To this end, for example, the control words are multiplexed with the scrambled multimedia content.
To secure the transmission of the control words, these words are transmitted to the terminals in the form of cryptograms. The term “cryptogram” herein designates a piece of information that is not sufficient by itself to retrieve the control word in plain form. Thus, if the transmission of the control word is intercepted, knowledge of the control word cryptogram alone does not make it possible to retrieve the control word by which the multimedia content can be descrambled. To retrieve the plain control word, i.e. the control word used to directly descramble the multimedia content, it must be combined with a piece of secret information. For example, the cryptogram of the control word is obtained by enciphering the plain control word with a cryptographic key. In this case, the secret information is the cryptographic key used to decipher this cryptogram. The cryptogram of the control word can also be a reference to a control word stored in a table containing a multitude of possible control words. In this case, the secret information is the table associating a plain control word with each reference.
The secret information should be kept in a secure place. To this end, it has already been proposed to store the secret information:
    • either in security processors such as hip cards directly connected to each of the terminals,
    • or more recently in control-word servers common to several terminals.
In the latter case, the terminals are devoid of chip cards. These terminals are then called cardless terminals.
The control-word server is connected to each of the terminals by a long-distance information-transmission network such as the Internet. When a control-word server is used, the cryptograms of the control words are first of all transmitted to the different terminals and then forwarded by these terminals to the control-word server. This procedure has several advantages. In particular, the information-transmission network used to broadcast the multimedia contents and the cryptograms of the control words can be different from the one used to connect the terminals to the control-word server. For example, the network for broadcasting multimedia content and cryptograms of the control words is a one-way network with a large bandwidth, for example a satellite network. Conversely, the network connecting the terminals to the control-word server is a two-way network with a bandwidth that may be smaller.
Then, this simplifies the time synchronization between the broadcasting of the multimedia contents and the broadcasting of the cryptograms of the corresponding control words.
The control-word server has the function of deciphering the cryptograms of the control words transmitted by the terminals and then sending the deciphered control word back to each of these terminals. Thus, in a way, the control-word server plays the role of a chip card common to several terminals that are mechanically and electrically independent of one another. Terminals that are electronically independent of one another are terminals that can work autonomously and have no electronic part common to them,
When a terminal needs a control word to descramble a multimedia content, it sends the control-word server a request containing the cryptogram of the control word. In response, the control-word server deciphers this cryptogram and then sends the deciphered control word to the terminal which can then descramble the desired multimedia content.
The multimedia contents broadcast over the different channels are temporally coordinated with one another. For example, the multimedia content broadcasting times are set so as to comply with the broadcasting times indicated in a pre-established program schedule. Each terminal on a given channel therefore receives appreciably the same multimedia content at the same time.
Thus, it often happens that users change channels (or stations) at the same time. For example, a simultaneous change of channel of this kind can be prompted by the broadcasting of an advertising sequence on the channel being currently viewed. The user is then said to have “zapped channels”.
In response to this change of channel, each terminal immediately transmits a request to the control-word server and, in response, receives the control word needed to descramble of the multimedia content currently being broadcast on the new channel being viewed. Thus, a massive and simultaneous change from one channel to another will cause a peak in the workload of the control-word server.
The computation power of the control-word server depends on this load peak. Thus, the greater the load peak, i.e. the greater the maximum number of requests to be processed in a predetermined time span, the greater is the computation power needed by the control-word server.
These workload peaks should be reduced as far as possible in order to limit the computation power needed by the control-word server while at the same limiting modifications made to the scrambled multimedia content transmission system.
SUMMARY OF THE INVENTION
The invention seeks to limit these load peaks of the control-word server. An object of the invention therefore, is a method for deciphering control words wherein.
    • the control-word server transmits, also to the first terminal, the control word CW2,t obtained by deciphering the cryptogram CW*2,t, transmitted by the second terminal even before the first terminal changes descrambled channels in passing from the first channel to the second channel, and
    • in response to the change in channel, the first terminal first seeks to find out if the control word CW2,t has already been transmitted in advance by the control-word server even before the change in channel and, if the answer is yes, the first terminal immediately starts descrambling the multimedia content broadcast on this second channel with the control word CW2,t transmitted in advance.
Through the above method, the first terminal has advance possession of the control word CW2,t needed to descramble the multimedia contents simultaneously broadcast on the second channel. Thus, if the user switches from the first channel to the second channel, it is not necessary for the first terminal to immediately transmit a request to the control-word server to be given the control word CW2,t. The load peaks of the control-word server are therefore reduced by preventing the systematic and immediate transmission of a large number of simultaneous requests to this control-word server in response to a channel change.
To implement this method, the first terminal does not need to transmit the cryptogram CW*2,t to the control-word server before the change in channel. This method is therefore simple to implement and minimizes the modifications to be made to the terminal
This method also reduces the waiting time before the multimedia content broadcast on the second channel can be descrambled. Indeed, the terminal does not have to immediately send a request to the control-word server and then wait for the control word CW2,t if it has already been transmitted in advance.
An object of the invention is also a method for transmitting control words CW1,t and CW2,t to first and second terminals that are mechanically and electronically independent of one another, wherein:
    • in response to the transmission of cryptograms CW*1,t and CW*2,t by the first and second terminals respectively, the same control-word server deciphers the cryptograms CW*1,t and CW*2,t to obtain respectively control words CW1,t and CW2,t, enabling the descrambling, respectively, of the first and second multimedia contents broadcast simultaneously on the first and second channels respectively, and then
    • the control word server transmits the control words CW1,t and CW2,t, respectively to the first and second terminals, and
    • the control-word server transmits, also to the first terminal, the control word CW2,t obtained by deciphering the cryptogram CW*2,t transmitted by the second terminal even before the first terminal changes descrambled channels in passing from the first to the second channel.
The embodiments of the transmission method may comprise one or more of the following characteristics:
    • in response to the transmission of a cryptogram CW*3,t to the same control-word server by a third terminal that is mechanically and electronically independent of the first and second terminals, the control-word server deciphers the cryptogram CW*3,t for each control word CW3,t to enable the descrambling of a third multimedia content broadcast on a third channel simultaneously with the first and second multimedia contents and then the control-word server selects the control word CW2,t from a table containing at least the control words CW2,t, and CW3,t and does not select the control word CW3,t, and then transmits only the control word selected from this table at the first terminal;
    • the control-word server:
    • builds an index; for each channel associated with control words contained in the table, this index representing the probability that the channel will soon be descrambled by the first terminal, and
    • selects, from the table, the control word or words to be transmitted to the first terminal as a function of this index;
    • the index of the second channel is built from a counting of the number of transmissions of the cryptogram CW*2,t by other terminals that are mechanically and electronically independent of the second terminal;
    • the control-word server transmits each control word associated with an identifier of the cryptoperiod or cryptoperiods that this control word serves to descramble.
These embodiments of the method of transmission furthermore have the following advantages:
    • transmitting only a part of the control words deciphered by the control-word server to the first terminal restricts the bandwidth used by this control-word server and this first terminal,
    • using an index representing the probability that a control word will be used by the first terminal in the event of a channel change provides for enhanced smoothing of the load peaks of the control-word server because it increases the probability of advance transmission of the control word which will become necessary in the event of a channel change;
    • building this index on the basis of the counting of the number of cryptograms CW*2,t transmitted by the other terminals refines the index and therefore restricts the probability of occurrence of a load peak of the control-word server;
    • should the control words be sent in pairs (ECW or even-parity control word and OCW or odd-parity control word), then the use of a cryptoperiod identifier averts the need to ask for a new pair of control words if at least one of the control words of a pair memorized in the terminal can be used to descramble the desired multimedia content.
An abject of the invention is also a method for the reception of control words CW1,t and CW2,t by a first terminal wherein:
    • the first terminal sends a cryptogram CW*1,t to a control-word server and receives in response a control word CW1,t, deciphered by this control-word server, this control word CW1,t being used to descramble a multimedia content broadcast on a first channel received by the first terminal,
    • the first terminal also receives the control word CW2,t to descramble another multimedia content simultaneously broadcast on a second channel, it being possible for this control word CW2,t to be obtained solely by the deciphering of a cryptogram CW*2,t by the control-word server,
    • the first terminal changes descrambled channels by passing from the first channel to the second channel.
      In this method of reception:
    • the first terminal receives the control word CW2,t even before the first terminal has changed channels without ever having preliminarily transmitted the cryptogram CW*2,t to the control-word server, and
    • in response to the channel change, the first terminal first of all makes a search to see if the control word CW2,t has already been transmitted in advance by the control-word server even before the change in channel and, if the answer is yes, the first terminal immediately starts descrambling the multimedia content broadcast on this second channel with the control word CW2,t transmitted in advance.
The embodiments of this reception method may comprise one or more of the following characteristics:
    • the first terminal descrambles a th cryptoperiod of the multimedia content broadcast on this first channel with the control word CW1,t and delays the transmission of a cryptogram CW*1,t+1, to descramble the (t+1)th cryptoperiod of the multimedia content broadcast on this same channel by a determined period of time to spread out, at least throughout the duration of the th cryptoperiod, the instants of transmission of the cryptograms CW*1,t+1 coming from different terminals that are mechanically and electrically independent of one another;
    • If the control word CW2,t has not been transmitted before the first terminal changes channels, the first terminal immediately transmits the cryptogram CW*2,t to the server of control words and then waits until it has received the control word CW2,t transmitted by the control-word servers before starting to descramble the multimedia content broadcast on the second channel:
    • the first terminal stores only the control word CW2,t in the form of a cryptogram EK1(CW2,t) obtained by enciphering the control word CW2,t with a secret key K1, the key K1 being known only to the first terminal and being unknown to the other terminals.
These embodiments of the reception method furthermore have the following advantages:
    • delaying the transmission of a cryptogram needed to descramble a following cryptoperiod of a multimedia content broadcast on the same channel lightens the workload of the control-word server; and
    • storing only the cryptogram EK1(CW2,t) in the terminal increases the security.
An object of the invention is also an information-recording medium comprising instructions to implement one of the above methods, when these instructions are executed by an electronic computer.
Finally, an object of the invention is the control-word server, this server being capable:
    • in reponse to the transmission of cryptograms CW*1,t and CW*2,t by the first and second terminals respectively, of deciphering the cryptograms CW*1,t and CW*2,t to obtain respectively control words CW1,t and CW2,t, the control words CW1,t and CW2,t enabling the descrambling, respectively, of the first and second multimedia contents broadcast simultaneously on the first and second channels respectively, and then
    • transmitting the control words CW1,t and CW2,t, respectively to the first and second terminals, and
    • transmitting, to the first terminal, the control word CW2,t obtained by deciphering the cryptogram CW*2,t transmitted by the second terminal even before the first terminal changes descrambled channels in passing from the first to the second channel.
BRIEF DESCRIPTION OF THE DRAWINGS
The invention will be understood more clearly from the following description, given purely by way of a non-restrictive example and made with reference to the appended drawings, of which:
FIG. 1 is a schematic illustration of a system for broadcasting scrambled multimedia contents,
FIG. 2 is a schematic illustration of a control word table used in the system of FIG. 1,
FIG. 3 is a flowchart of a method for transmitting scrambled multimedia contents by means of the system of FIG. 1,
FIG. 4 is a flowchart of another method for transmitting scrambled multimedia contents by means of the system of FIG. 1, and
FIG. 5 is a schematic illustration of another embodiment of a table of control words used in combination with the method of FIG. 4.
In these figures, the same references are used to designate the same elements.
DETAILED DESCRIPTION OF THE INVENTION
Here below in this description, the characteristics and functions well known to those skilled in the art shall not be described in detail. Furthermore, the terminology used is that of systems of conditional access to multimedia contents. For further information on this terminology, the reader may refer to the following document:
    • “Functional Model of Conditional Access System”, EBU Review, Technical European Broadcasting Union, Brussels, BE, n° 266, 21 Dec. 1995.
FIG. 1 represents a system 2 for sending and receiving multimedia contents. A multimedia content corresponds for example to a sequence of an audio/visual program such as a television broadcast or a film.
Plain multimedia contents are generated by one or more sources 4 and transmitted to a device 6 for simultaneous broadcasting to a multitude of reception devices through an information-transmission network 8. The multimedia contents broadcast are time-synchronized with one another so as for example to comply with a pre-established program schedule.
The network 8 is typically a long-distance information-transmission network such as the Internet or a satellite network or any other broadcasting network such as the one used to transmit digital terrestrial television (DTTV).
To simplify FIG. 1, only three reception devices 10 to 12 are shown.
The device 6 includes an encoder 16 which compresses the multimedia contents that it receives. The encoder 16 processes digital multimedia contents. For example, this encoder works in compliance with the MPEG2 (Moving Picture Expert Group-2) standard or the UIT-T H264,
The compressed multimedia contents are directed towards an input 20 of a scrambler 22. The scrambler 22 scrambles each compressed multimedia content to make its viewing conditional on certain terms such as the purchase of an access entitlement by the users of the reception devices. The scrambled multimedia contents are rendered at an output 24 connected to the input of a multiplexer 26.
The scrambler 22 scrambles each compressed multimedia content by means of a control word CWi,t that is given to it as well as to a conditional access system 28 or CAS by a key generator 32. The index i is an identifier of the channel on which the scrambled multimedia content is broadcast and the index t is an identifier of the cryptoperiod scrambled with this control word.
Typically, this scrambling is compliant with a standard such as the DVB-CSA (Digital Video Broadcasting—Common Scrambling Algorithm), ISMA Cryp (Internet Streaming Media Alliance Cryp), IPsec (Internet Protocol Security Keying Information Resource Record Working Group), SRTP (Secure Real-time Transport Protocol), or other such standards.
The system 28 generates ECM (Entitlement Control Messages) containing at least the cryptogram CW*i,t of the control word CWi,t generated by the generator 32 and used by the scrambler 22 for each cryptoperiod of each multimedia content. These messages and the scrambled multimedia contents are multiplexed by the multiplexer 26, these scrambled multimedia contents being respectively given by the conditional access system 28 and the scrambler 22 and then transmitted on the network 8.
The system 28 also inserts the following in each ECM:
    • the identifier i of the channel,
    • an instant tdiff of the first broadcast of the ECM by the device 6, and
    • access rights DA to be compared with access entitlements acquired by the user.
The same identifier is inserted in all the ECM messages containing a cryptogram CW*i,t for the descrambling of the multimedia content broadcast on a same channel.
By way of an illustration here, the scrambling and the multiplexing of the multimedia content here is compliant with the DVB-Simulcrypt protocol. In this case, the identifier i may correspond to a unique “channel ID/stream ID” pair on which are sent all the requests for the generation of ECM messages for this channel.
For example, the terminals 10 to 12 are identical and only the terminal 10 is described in greater detail.
The reception device 10 includes a receiver 70 of broadcast multimedia contents. This receiver 70 is connected to the input of a demultiplexer 72 which transmits on the one hand the multimedia content to a descrambler 74 and on the other hand the ECM and EMM (Entitlement Management Message) messages to a processor 76. The processor 76 processes confidential information such as cryptographic keys. In order that the confidentiality of this information may be preserved, it is designed to be as robust as possible against attempted attacks by computer hackers. It is therefore more robust against these attacks than the other components of the device 10. This robustness is obtained for example by implementing a software module dedicated to the protection of secret information.
The processor 76 is made for example by means of programmable electronic computers capable of executing instructions recorded on an information-recording medium. To this end, the processor 76 is connected to a memory 78 containing the instructions needed to execute the methods of FIG. 3 or 4.
The memory 78 also contains:
    • a cryptographic certificate to authenticate the terminal 10, and
    • a local table 79 of control words.
The descrambler 74 descrambles the scrambled multimedia content using the control word transmitted by the processor 76. The descrambled multimedia content is transmitted to a decoder 80 which decodes it. The decompressed or decoded multimedia content is transmitted to a graphic card 82 which drives the display of this multimedia content on a display unit 84 equipped with a screen 86.
The display unit 84 provides a plain display of the multimedia content on the screen 86,
The terminal 10 also has a sender 88 used to set up a secured connection with a network tunnel endpoint 90 by means of an information-transmission network 92. For example, the network 92 is a long-distance information-transmission network and more specifically a packet-switching network such as the Internet. The secured connection is for example a secured tunnel
The network tunnel endpoint 90 has a module 100 for managing the access entitlements of the different users of the system 2. This module 100 is better known as a “subscriber authorization system” This module 100 generates a database 102 and keeps it up to date. With each user identifier, the database 102 associates the access entitlements acquired by this user. This database 102 is stored in a memory 104.
The tunnel end point 90 also has a server 1038 of control words connected to an access-right checking module 108 and a memory 110 containing a table 112 of control words. Typically, the server 106 is made out of programmable electronic computers capable of executing instructions recorded in an information-recording medium. To this end, the memory 110 also has instructions to execute the method of FIG. 3 or 4.
An example of a structure of the table 112 is shown in greater detail in FIG. 2. Each row of the table 112 corresponds to a recording. The table 112 has several recordings. Each recording corresponds to an ECM message. Each of these recordings contains the following fields:
    • a field i containing the identifier of the broadcast channel,
    • a field CWt containing the control word CWi,t used to scramble the cryptoperiod t of the multimedia content broadcast on the channel i,
    • a field CWt+1 containing the control word CWi,t+1 used to scramble the cryptoperiod t+1 immediately following the multimedia content broadcast on the channel
    • a field CA containing the conditions of access to the multimedia content,
    • a field DV containing the duration of validity of the control words CWi,t and CWi,t+1,
    • a field MAC containing information to check the integrity of the ECM message received, and
    • a field trecept containing the instant of reception of the ECM message used to obtain the pair of control words CWi,t/CWi,t+1.
The structure of the table 79 is for example identical to the structure of the table 112.
The working of the system 2 shall now be described in greater detail with reference to the method described in FIG. 3.
Initially, at a step 120, the device 6 broadcasts several different multimedia contents simultaneously on different channels. On each channel, the cryptoperiod t and the next cryptoperiod t+1 are scrambled with the control words, CWi,t and CWi,t+1. The ECM messages containing the cryptograms CW*i,t and CWi,t+1 of the control words CWi,t and CWi,t+1 are multiplexed with the broadcast multimedia contents. This multiplexing synchronizes the broadcasting of the control words with the broadcasting of the multimedia contents. Typically, the ECM messages are repeated several times within a same cryptoperiod. For example, the ECM messages are repeated every 0.1 second to 0.5 seconds. The duration of a cryptoperiod is greater than 10 seconds and preferably greater than 5 or 10 minutes in order to further limit pressure on the control-word servers.
The scrambled multimedia contents are received appreciably at the same time by each of the terminals 10 to 12. The following steps are therefore executed appreciably in parallel for each of these terminals. It is also assumed that the different terminals simultaneously descramble a multimedia content each, broadcast on a respective channel. The next steps are described in the particular case of the terminal 10.
At a step 122, the scrambled multimedia contents with ECM messages are received by the receiver 70.
Then, at a step 124, the demultiplexer 72 extracts the scrambled multimedia content corresponding to the channel i for which the descrambling is currently being requested by the user. At the step 124, the demultiplexer 72 also extracts solely the ECM messages containing the cryptograms of the control words to descramble this same channel. The demultiplexer 72 transmits the extracted multimedia content to the descrambler 74. The extracted ECM messages for their part are transmitted to the processor 76.
At a step 126, the processor 76:
    • searches to see if the MAC signature of the transmitted ECM already present in its local table 79, and
    • ascertains by means of the duration of validity DV that the control words associated with this signature are valid.
If the control words found in the table 79 are valid, then the terminal proceeds to a phase 127 for descrambling the multimedia content broadcast on the channel i.
More specifically, at a step 128, the processor 76 sends the descrambler 74 the control words CWi,t and CWi,t+1 associated with this MAC signature in the table 79. No request to decipher the cryptograms CW*i,t and CW*i,t+1 is immediately transmitted to the server 106.
In response, the descrambler at a step 130, descrambles the multimedia content received through this pair of control words CWi,t/CWi,t+1.
At a step 132, the descrambled multimedia content is decoded by the decoder 80 and then transmitted to the video card 82.
Finally, at a step 134, the video card 82 transmits the video signal to the display device 84 so that the multimedia content gets displayed on the screen 86 in a way that is directly perceptible and comprehensible to a human being.
If the MAC signature is not in the table 79 or if the associated control words have expired, then the processor 76 performs a step 138 during which it checks to see if the user has changed channels. For example, it compares the channel identifier contained in the received ECM received with the channel identifier contained in the previous received ECM message.
If the answer is yes then, at a step 140, the terminal 10 immediately sends a request to the server 106 to decipher the cryptograms CW*i,t and CW*i,t+1 contained in the ECM message received. This request contains the ECM message received and therefore the pair of cryptograms CW*i,t/CW*i,t+1 as well as an identifier of the user of the terminal that has sent the request. This request is transmitted to the server 106 through the sender 88 and the network 92. All these exchanges of information between the terminal and the server 106 are done by means of a secured tunnel set up through the network 92. The setting up of the tunnel calls for the authentication and identification of the terminal by the server 106, for example using the cryptographic certificate contained in the memory 78.
If the answer is negative, then at a step 142, the processor 76 delays the transmission of this request. To this end, the processor 76 determines a period of waiting before activating the sending of the request to the server 106. This waiting period is determined so as to smoothen the instants at which these requests are sent by different terminals having received this new ECM message at the same time. The waiting time is however chosen systematically to be short enough to enable the reception of the pair of control words CWi,t/CWi,t+2 deciphered before the end of the cryptoperiod t. For example, at the step 142, the processor 76 randomly or pseudo-randomly draws a number and, depending on this random number, determines the duration of the waiting to be applied. After the waiting duration, the result is sent to the server 106.
This temporal smoothing of the instants at which the request is sent to the server 106 by different terminals using the same control-word server limits the appearance of load peaks. In particular, this prevents a situation of having a load peak in response to each first broadcast of a new ECM.
At a phase 144, the server 106 responds as quickly as possible to the request sent at the end of the step 140 or 142.
For example, in response to the reception of such a request at a step 146, the server 106 selects recordings in the table 112 to build a new local table for this terminal. To this end, the module 108 extracts, from the base 102, the access entitlements corresponding to the user identifier contained in the request. Then, the server 106 selects, in the table 112, only the control words associated with access rights DA corresponding to access to the extracted access entitlements. Then, this local table is limited to the N pairs of control words corresponding to the N channels to which it is most probable that the user will be zapping, where N is an integer greater than 1 and preferably greater than 2 or 10. To this end, the server 106 builds and uses indices Pi associated with each channel i. These indices P, represent the probability that the user will change to the channel i. By way of an illustration, here, the index P, is the value of a counter Ci. For each channel i, a counter Ci counts the number of times when a request to decipher a pair of control words CWi,t/CWi,t+1 has been received by the server 106 during a sliding window. Typically, the duration S1 of the sliding window is greater than at least one cryptoperiod and preferably greater than several cryptoperiods. For example, the duration S1 ranges from 30 seconds to five minutes. The counter Ci is incremented by a step whatever the terminal that has sent a request to obtain a control word enabling the channel to be descrambled. The value of the counter Ci is therefore equal to the number of times in which, during the period S1 the server 106 has received a request to decipher a control word necessary for the descrambling of this channel. Thus, the value of the counter Ci is all the greater as the number of terminals descrambling the channel i is great. The value of the counter Ci therefore indicates the channels that are most requested by the users. In this embodiment, it is considered that the more the channel i is in demand, the more probable it is that a channel will change its current channel to descramble the channel i. For example, the counter C, is stored in the memory 110.
Then, at a step 148, the server 106 makes a check to see if the ECM contained in the request of the terminal 10 has already been received. For example, to this end, it compares the MAC signature of the ECM received with the MAC signatures contained in the table 112.
If the MAC signature is not already in the table 112, it means that this ECM is received for the first time by the server 106. The server 106 then carries out a phase 150 of updating the table 112. This phase starts with a step 150 during which the server 106 deciphers the pair of cryptograms CW*i,t/CW*i,t+1 contained in the ECM received. At the step 152, the server 106 also computes a duration of validity DV for the control words thus deciphered. For example, this duration of validity is computed by means of the following formula:
DV=t diff+2×CP−t proc
where
    • tdiff is the instant of the first broadcast of the ECM by the device 6, this instant being contained in the ECM received,
    • CP is the known duration of a cryptoperiod, and
    • tproc is a predetermined value corresponding appreciably to the time of transmission of an ECM message from the device 6 to the server 106 and for the processing of this message by the server 106 and the terminal.
Then, the server 106 adds a new recording in the table 112. This new recording contains:
    • the identifier i of the channel contained in the ECM,
    • the new pair of control words CWt/CWt+1,
    • the access rights DA,
    • the MAC signature of the received ECM,
    • the computed duration of validity DV, and
    • the instant trecept of reception of the ECM by the server 106.
The phase 150 also comprises a step 154 for managing the sliding window during which the server checks to see if the difference between the current instant tc and the reception instant trecept of a recording in the table 112 does not exceed the duration S1. If the answer is yes, the corresponding recording is erased from the table 112. At the same time, the counter Ci associated with the identifier of the erased recording is decremented by one step. Should the threshold S1 not be crossed, the recording is not erased and remains contained in the table 112.
The step 115 is reiterated at regular intervals so as to erase those recordings from the table 112 that have become obsolete.
If the ECM message contained in the request is already in the table 112, or at the end of the step 152, the server 106 performs a step 160 during which it increments the counter Ci associated with the identifier i contained in the processed ECM.
At a step 162, the server 106 checks to see if the access rights contained in the received ECM message correspond to the access entitlements of the user who has transmitted this ECM message. If the answer is yes, and if the local table of the control words built during the step 146 does not already contain the pair CWi,t/CWi,t+1, the recording created from the received ECM is added to this local table.
If not, no recording containing the pair CWi,t/CWi,t+1 is added to the local table.
Finally, the server 106 sends the terminal 10, in response to its request, the local table built by the server 106. This new local table received by the terminal then replaces the table 79 previously used by the terminal 10.
Through this method, when a large number of users change channels at the same time, the probability that the control word needed to descramble the new channel is already contained in the table 70 is great. This makes it possible to limit the load peaks of the server 106 following simultaneous channel-changing by a large number of users.
It will be noted however, that if the local table 79 contains the pair CWi,t/CWi,t+1 for the channel and the change in channel occurs during the cryptoperiod t+1, then the terminal immediately sends a request to the server 106 to obtain the pair CWi,t+1/CWi,t+2. Indeed, the MAC signature of the ECM message containing the pair CWi,t+1/CWi,t+2 is not the same as that of the ECM message containing the pair CWi,t/CWi,t+1. It may be desirable to have available a method similar to that of FIG. 3 but enabling the terminal to exploit the control word CWi,t+1 contained in the local table 79 to start immediately descrambling the multimedia content broadcast on the channel i without having to immediately send a request to the server 106.
The method of FIG. 4 furthermore makes it possible to comply with this requirement. To this end, an order number NECMi is inserted in each message ECMi,t to identify the message ECMi,t preceding the message ECMi,t+1. The number NECMi is inserted into each ECM message by the device 6.
To implement the method of FIG. 4, the structure of the tables 79 and 112 is modified to correspond to that of the table 200 (FIG. 5). The table 200 is identical to the table 112 except for the fact that, for each recording, it has an additional field NECMi corresponding to the order number of the ECM message associated with a particular channel i.
Furthermore, in the method of FIG. 4, the selection of the control word is modified to take account solely of the past behavior of the user who has sent the request to the server 106. To this end, each counter Ci is replaced by counters Cij, where the index i is an identifier of the channel and the index j is an identifier of the user of the terminal. Each counter Cij counts the number of times where the user j has sent a request to descramble the channel during the sliding window of a duration S1. This counter is therefore not modified by the information contained in requests coming from other terminals than that used by the user j. The value of each of these counters Cij is therefore an index Pij representing the probability that the user changes channels to pass to this channel i. The selection of the control words incorporated into the local table built by the server 106 for this user j is done as a function of the index Pij. This adapts the building of the local table for the user j according to his past behavior.
The method of FIG. 4 is identical to the method of FIG. 3 except that the step 126 and the phases 127 and 144 are replaced respectively by the step 178 and the phases 179 and 192.
At the step 178, the processor 76 checks to see whether a valid control word required to descramble the broadcast multimedia content is already present in the table 79. To this end, the duration of validity DV associated with the identifier i in the table 79 is compared with the current instant tc. Furthermore, the processor 76 also checks to see whether the order number NECMi contained in the ECM message received is equal to the order number NECMi associated with the identifier i in the table 79 or with the previous order number.
If the answer is yes, the processor 76 proceeds to the phase 179 for descrambling the multimedia content broadcast on the channel 1. This phase 179 is identical to the phase 127 except that the step 128 is replaced by a step 182. This step 182 is identical to the step 128 but in addition to the operations described here above, the processor 76 sends the descrambler 74 the pair of control words CWi,t+1/CWi,t if the order number NECMi contained in the table 79 is equal to the received order number NECMi−1.
Thus, even in response to the change in channel during the cryptoperiod t+1, the reception of an ECM message containing the cryptograms CW*i,t/CW*i,t+1 does not trigger the immediate sending of a new request to the server 106. On the contrary, this request is delayed so as to smooth the transmission of these requests to the server 106 to prevent load peaks.
The phase 192 is identical to the phase 144 except that the steps 146, 160 and 162 are replaced by steps 194, 196 and 198.
The step 194 is identical to the step 146 except that it is only the indices Pij associated with the user j that are used to select the recordings to be included in the local table built by the server 106.
The step 196 is identical to the 160 except that only the counter Cij specific to the user j and to the channel i is incremented whenever a new request to descramble this channel is received by the server 106.
The phase 150 is also replaced by a phase 197 identical to the phase 150 except that this phase 154 is replaced by another step 198 for managing the sliding window. At the step 198, all the counters Cij associated with the channel i of the erased recording are decremented at the same time. Consequently, the duration S1 can be far greater than in the case of the method of FIG. 3. For example, the duration S1 ranges from one to four weeks.
The method of FIG. 4 has several advantages. In particular, it can be used to descramble a new channel without immediately transmitting a new request to the server 106 provided that one of the two control words of a pair of control words can validly be used to descramble this channel.
Then, the use of the indices Pij increases the probability that, during a change in channel, the control word needed is already contained in the table 79. This therefore further limits the load peaks.
Many other embodiments are possible. In particular, there are many other existing possibilities for selecting the recordings of the table 112 used to build the table 79. In a first variant, the local table of control words is built by combining the teachings given with reference to FIGS. 3 and 4. For example, the local table is built by the server 106 by selecting recordings as a function of both the indices P and P.
In another variant, at least some of the recordings to be selected are identified manually by the user of the terminal 10. For example, during an initialization phase, the user of the terminal 10 interacts with the terminal to acquire a list of channel identifiers between which the user wishes to navigate rapidly. This list is transmitted to the server 106 which records it. Then, whenever an ECM message is transmitted by this terminal, the recordings corresponding to the channels referenced in the list are systematically incorporated into the local table of control words built by the server 106.
Indices of probabilities other than those described here above can be used to select the recordings to be incorporated into the local table. For example, the index can also depend on the initial channel descrambled before the channel is changed.
In a very simplified embodiment, the set of control words contained in the table 112 and corresponding to the access entitlements of the user are sent to the terminal in response to each request from this terminal. Thus, the different counters or indices enabling the selection of a limited number of recordings among all the recordings contained in the table 112 are omitted.
The channel identifier incorporated into the ECM message can be generated by the terminal itself and incorporated solely into the request transmitted to the control-word server. In this case, it is not necessary for this channel identifier to be incorporated into the ECM messages built by the system 28.
The updating of the table 79 is not necessarily activated by the reception of a new ECM message for the currently requested channel. For example, in another embodiment, a request for updating the table 79 is automatically sent to the server 106 by the terminal immediately upon expiry of the duration of validity of the control words contained in this table for one or more channels, even if the channels are not currently descrambled. The sending of a request for updating the table 79 can also be activated as soon as the number of control words for which the duration of validity has expired exceeds a predetermined threshold. Preferably, this threshold is expressed as a percentage of a total number of control words contained in the table 79. Preferably, these requests for updating the table 79 are smoothened in time so as not to prompt load peaks on the server 106.
As a variant, the deciphering of each cryptogram CW*i,t contained in an ECM message transmitted to the server 106 is done solely if the access rights contained in this same ECM correspond to the access entitlements of the user who has sent this ECM.
Other method for smoothing the sending, in time, of the requests to the server 108 can be used. These other methods do not necessarily have recourse to the drawing of a random number.
In another variant, the updating of the table 79 is limited solely to the recordings whose duration of validity has expired or is on the point of expiry. To this end, each request transmitted by a terminal to the server 106 also contains an image of the control words currently contained in the table 79. For example, this image is constituted by the identifier i of the channel associated with the order number NECMi in the table 79. Thus, the server 106 identifies only the recording or recordings for which an updating is necessary and transmits only these recordings during the step 162. This limits the bandwidth needed to send local tables through the server 106.
Approaches other than the use of a secured tunnel to protect the transmission of the control words between a terminal and the server 106 are possible. For example, each pair of control words is enciphered by the server 106 with a private key K1 known only to the terminal to which this pair of control words must be transmitted.
The control word table transmitted to the terminal then contains only the cryptograms EK1(CWi,t) thus obtained. The other pieces of information of the local table can be non-enciphered. Consequently, the pairs of control words stored in the terminal are stored solely in enciphered form. The deciphering of these pairs of control words takes place only when the descrambling of the corresponding channel is activated. This increases security.
There are other approaches to securing the transmission of the control words from the server 106 to the terminals. For example, the device 6 carries out a first encipherment of the control words in plain form with a key K1 and then a second encipherment with a key K2. The ECM messages then contain the cryptogram EK2K1(CWi,t) instead of the cryptogram CW*i,t. In response to a request from a terminal, the server 106 deciphers the cryptogram EK2K1(CWi,t) for a first time with the key K2 to obtain the control word EK1(CWi,t). This control word EK1(CWi,t) is transmitted in response to the terminal. The control word EK1(CWi,t) enables the descrambling of the multimedia content after it has been deciphered a second time by the terminal with the key K1.
The smoothening of the load peaks is all the more efficient as the duration of the cryptoperiods is long. However, instead of lengthening the duration of a cryptoperiod, it is also possible to re-use the same control word in several successive cryptoperiods. Indeed, this makes it possible to distribute the requests sent to the control-word server over a lengthier duration. However, this method has the advantage of enabling a comparison of the access rights with the access entitlement of the user during each cryptoperiod.
An identifier of the terminal can be used in place of the user identifier.
The characteristics of the methods of FIGS. 3 and 4 can be combined.

Claims (14)

The invention claimed is:
1. A method for deciphering control words for a first terminal and at least one second terminal, said first terminal and said at least one second terminal being mechanically and electronically independent of one another, said method comprising causing said first terminal to transmit a first cryptogram to a control-word server, causing said at least one second terminal to transmit a second cryptogram to said control-word server, causing said control-word server to decipher said first cryptogram to obtain a first control word for enabling descrambling of first multimedia content broadcast on a first channel, causing said control-word server to decipher said second cryptogram to obtain a second control word for enabling descrambling of second multimedia content broadcast on a second channel simultaneously with said first multimedia content, causing said control-word server to transmit said first control word to said first terminal, causing said control-word server to transmit said second control word to said at least one second terminal, causing said control-word server to also transmit said second control word to said first terminal, said second control word being obtained by deciphering said second cryptogram transmitted by said second terminal before said first terminal executes a channel change by changing descrambled channels in passing from said first channel to said second channel, and in response to said channel change, causing said first terminal to execute a search to determine whether said second control word has already been transmitted in advance by said control-word server before said channel change, and if said control word has been transmitted in advance, causing said first terminal to immediately start descrambling said second multimedia content broadcast on said second channel with said second control word, said second control word having been transmitted in advance.
2. A method of transmitting a first control word to a first terminal and a second control word to a second terminal, wherein said second terminal is mechanically independent of said first terminal, wherein said first terminal is electronically independent of said second terminal, wherein said first terminal has been caused to transmit a first cryptogram to a control-word server, and wherein a second terminal has been caused to transmit a second cryptogram to said control-word server, said method comprising, in response to transmission of first and second cryptograms to said control-word server by said first and second terminals respectively, causing said control-word server to decipher said first cryptogram to obtain a first control word and causing said control-word server to decipher said second cryptogram to obtain a second control word, said first control word enabling descrambling of first multimedia content and said second control word enabling descrambling of second multimedia content, wherein said first multi-media content and said second multi-media content are broadcast simultaneously on said first and second channels respectively, causing said control-word server to transmit said first control word to said first terminal, causing said control-word server to transmit said second control word to said second terminal, causing said control-word server to transmit, to said first terminal, said second control word, said second control word having being obtained by deciphering said second cryptogram transmitted by said second terminal before said first terminal changes descrambled channels in passing from said first channel to said second channel.
3. The method of claim 2, wherein in response to transmission of a third cryptogram to said control-word server by a third terminal that is mechanically and electronically independent of said first and second terminals, causing said control-word server to decipher said third cryptogram to obtain a third control word that enables descrambling of third multimedia content broadcast that is being broadcast on a third channel simultaneously with broadcasting of said first and second multimedia content on said first and second channels, and causing said control-word server to select said second control word but not said third control word from a table containing at least said second and third control words and to transmit only control words selected from said table at said first terminal.
4. The method of claim 3, further comprising causing said control-word server to build an index for each channel associated with control words contained in said table, said index representing a probability that said channel will soon be descrambled by said first terminal, and to select, from said table, one or more control words to be transmitted to said first terminal as a function of said index.
5. The method of claim 4, wherein building an index for each channel comprises building an index of said second channel from counting transmissions of said second cryptogram by other terminals that are mechanically and electronically independent of said second terminal.
6. The method of claim 2, further comprising causing said control-word server to transmit each control word associated with an identifier of one or more crypto-periods that said control word serves to descramble.
7. A method for receiving first and second control words by a first terminal, said method comprising causing said first terminal to send a first cryptogram to a control-word server and to receive in response a first control word deciphered by said control-word server, said first control word being usable to descramble multimedia content broadcast on a first channel received by said first terminal, causing said first terminal to receive a second control word to descramble second multimedia content that is broadcast on a second channel, said first and second multimedia content being broadcast simultaneously on said first and second channels, wherein said second control word is obtained solely by deciphering a second cryptogram by said control-word server, causing said first terminal to change descrambled channels by passing from said first channel to said second channel, wherein said first terminal receives said second control word before said first terminal changes channels without having preliminarily transmitted said second cryptogram to said control-word server, and wherein in response to said channel change, said first terminal executes a search to see if said second control word has already been transmitted in advance by said control-word server before said channel change, wherein said first terminal begins descrambling said multimedia content broadcast on said second channel with said second control word that was transmitted in advance of said channel change.
8. The method of claim 7, wherein said first terminal descrambles a first crypto-period of said first multimedia content broadcast on said first channel with said first control word and delays transmission of a cryptogram to descramble a second crypto-period of said multimedia content broadcast on said first channel by a determined period of time to spread out, at least throughout a duration of said first crypto-period, instants of transmission of cryptograms coming from different terminals that are mechanically and electrically independent of one another.
9. The method of claim 7, wherein, if said second control word has not been transmitted before said first terminal changes channels, said first terminal immediately transmits said second cryptogram to said control-word server and then waits until receiving said second control word from said control-word server before starting to descramble said multimedia content broadcast on said second channel.
10. The method of claim 7, wherein said first terminal stores only said second control word as a cryptogram obtained by enciphering said second control word with a secret key, said secret key being known only to said first terminal and being unknown to other terminals.
11. A tangible and non-transitory information-recording medium having encoded thereon instructions that, when executed by a computing system, cause execution of said method recited in claim 7.
12. The method of claim 7, wherein said second control word is obtained solely by deciphering a second cryptogram that was received by said control-server from a second terminal, subsequently deciphered by said control-word server, and sent to said first terminal by said control-word server.
13. A tangible and non-transitory information-recording medium having encoded thereon instructions that, when executed by a computing system, cause execution of said method recited in claim 2.
14. An apparatus comprising a control-word server for transmission of a first control word to a first terminal and a second control word to a second terminal, wherein said first terminal and said second terminal are mechanically and electronically independent of each other, wherein said control-word server is configured to respond to transmission of first and second cryptograms by said first and second terminals respectively by deciphering said first cryptogram to obtain a first control word that enables descrambling of said first multimedia content broadcast on said first channel and deciphering said second cryptogram to obtain a second control word that enables descrambling of said second multimedia content broadcast on said second channel, wherein said first multimedia content and said second multimedia content are broadcast simultaneously, to transmit said first control word to said first terminal, to transmit said second control word to said second terminal, and to transmit to said first terminal, said second control word obtained by deciphering said second cryptogram transmitted by said second terminal even before said first terminal changes descrambled channels in passing from said first channel to said second channel.
US13/519,661 2009-12-28 2010-12-20 Control-word deciphering, transmission and reception methods, recording medium and server for these methods Expired - Fee Related US8615650B2 (en)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
FR0959612A FR2954875B1 (en) 2009-12-28 2009-12-28 METHODS OF DETECTING, TRANSMITTING AND RECEIVING CONTROL WORDS, RECORDING MEDIUM AND SERVER FOR THESE METHODS
FR0959612 2009-12-28
PCT/EP2010/070318 WO2011080150A1 (en) 2009-12-28 2010-12-20 Methods for decrypting, transmitting and receiving control words, storage medium and server for said methods

Publications (2)

Publication Number Publication Date
US20120290831A1 US20120290831A1 (en) 2012-11-15
US8615650B2 true US8615650B2 (en) 2013-12-24

Family

ID=42313812

Family Applications (1)

Application Number Title Priority Date Filing Date
US13/519,661 Expired - Fee Related US8615650B2 (en) 2009-12-28 2010-12-20 Control-word deciphering, transmission and reception methods, recording medium and server for these methods

Country Status (8)

Country Link
US (1) US8615650B2 (en)
EP (1) EP2520042B1 (en)
CN (1) CN102714593B (en)
ES (1) ES2703395T3 (en)
FR (1) FR2954875B1 (en)
PL (1) PL2520042T3 (en)
TW (1) TWI523533B (en)
WO (1) WO2011080150A1 (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10091537B2 (en) 2011-10-31 2018-10-02 Nagravision S.A. Method and multimedia unit for processing a digital broadcast transport stream
US10936701B2 (en) 2016-01-26 2021-03-02 Twentieth Century Fox Film Corporation Method and system for conditional access via license of proprietary functionality

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR2978848B1 (en) * 2011-08-02 2013-08-30 Viaccess Sa METHOD FOR SMOOTHING THE WORKING LOAD OF A SERVER
CN105791954B (en) * 2014-12-23 2019-02-01 深圳Tcl新技术有限公司 Digital TV terminal conditional access method, terminal and system
FR3044442B1 (en) * 2015-11-27 2018-02-09 Viaccess METHOD FOR IDENTIFYING SECURITY PROCESSORS
US10375030B2 (en) * 2016-06-24 2019-08-06 Combined Conditional Access Development & Support Initialization encryption for streaming content
WO2021046410A1 (en) 2019-09-04 2021-03-11 The Johns Hopkins University Functional metal oxides and methods of making same
CN111510764B (en) * 2020-04-15 2022-06-17 青岛海信宽带多媒体技术有限公司 Control display method and display device of household intelligent set top box
US11595715B2 (en) * 2020-04-28 2023-02-28 Hulu, LLC Recent channels pre-calculation in video delivery

Citations (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR2694860A1 (en) 1992-08-13 1994-02-18 France Telecom Methods of broadcasting and receiving conditional access television programs with reduced program switching time.
US5719941A (en) 1996-01-12 1998-02-17 Microsoft Corporation Method for changing passwords on a remote computer
US20040017918A1 (en) * 2002-07-24 2004-01-29 Christophe Nicolas Process for point-to-point secured transmission of data and electronic module for implementing the process
US20040111740A1 (en) * 2002-11-28 2004-06-10 Jong-Won Seok Broadcasting server system for protecting and managing digital broadcasting contents and an operation method thereof
US20040168063A1 (en) * 2003-01-31 2004-08-26 Dan Revital Virtual smart card device, method and system
WO2005020564A1 (en) 2003-08-13 2005-03-03 Thomson Licensing S.A. Pre-processing of descrambling data to reduce channel-change time
US20060150211A1 (en) * 2004-12-31 2006-07-06 Swisscom Mobile Ag Method and terminal for limited-access receiving of data as well as remote server
EP1705915A1 (en) 2005-03-22 2006-09-27 Nagravision S.A. Method for managing access to conditional access data reaching a faster zapping
US20070124807A1 (en) 2005-11-29 2007-05-31 Taiwan Semiconductor Manufacturing Co., Ltd. Password update systems and methods
WO2008002312A1 (en) 2006-06-28 2008-01-03 Thomson Licensing Method and apparatus for reducing channel change times
US7466826B2 (en) * 2000-12-07 2008-12-16 Thomson Licensing Method of secure transmission of digital data from a source to a receiver
US20090183196A1 (en) * 2008-01-16 2009-07-16 Qualcomm Incorporated Methods and apparatus to reduce channel switching time
US7900041B2 (en) * 2003-07-22 2011-03-01 Irdeto Canada Corporation Software conditional access system
US8239957B2 (en) * 2006-11-02 2012-08-07 Nds Limited Privacy-aware content protection system

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1510066A1 (en) * 2002-05-21 2005-03-02 Koninklijke Philips Electronics N.V. Conditional access system
EP1575293A1 (en) * 2004-03-11 2005-09-14 Canal+ Technologies Dynamic smart card management
FR2905215B1 (en) * 2006-08-23 2009-01-09 Viaccess Sa METHOD OF TRANSMITTING COMPLEMENTARY DATA TO A RECEPTION TERMINAL
CN101272474B (en) * 2007-03-23 2011-03-09 北京东方广视科技股份有限公司 Method for fast switching channels

Patent Citations (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR2694860A1 (en) 1992-08-13 1994-02-18 France Telecom Methods of broadcasting and receiving conditional access television programs with reduced program switching time.
US5719941A (en) 1996-01-12 1998-02-17 Microsoft Corporation Method for changing passwords on a remote computer
US7466826B2 (en) * 2000-12-07 2008-12-16 Thomson Licensing Method of secure transmission of digital data from a source to a receiver
US20040017918A1 (en) * 2002-07-24 2004-01-29 Christophe Nicolas Process for point-to-point secured transmission of data and electronic module for implementing the process
US20040111740A1 (en) * 2002-11-28 2004-06-10 Jong-Won Seok Broadcasting server system for protecting and managing digital broadcasting contents and an operation method thereof
US20040168063A1 (en) * 2003-01-31 2004-08-26 Dan Revital Virtual smart card device, method and system
US7900041B2 (en) * 2003-07-22 2011-03-01 Irdeto Canada Corporation Software conditional access system
US20090153747A1 (en) * 2003-08-13 2009-06-18 Thomason Licensing S.A. Pre-Processing of Descrambling Data to Reduce Channel-Change Time
WO2005020564A1 (en) 2003-08-13 2005-03-03 Thomson Licensing S.A. Pre-processing of descrambling data to reduce channel-change time
US20060150211A1 (en) * 2004-12-31 2006-07-06 Swisscom Mobile Ag Method and terminal for limited-access receiving of data as well as remote server
EP1705915A1 (en) 2005-03-22 2006-09-27 Nagravision S.A. Method for managing access to conditional access data reaching a faster zapping
US20070124807A1 (en) 2005-11-29 2007-05-31 Taiwan Semiconductor Manufacturing Co., Ltd. Password update systems and methods
WO2008002312A1 (en) 2006-06-28 2008-01-03 Thomson Licensing Method and apparatus for reducing channel change times
US8239957B2 (en) * 2006-11-02 2012-08-07 Nds Limited Privacy-aware content protection system
US20090183196A1 (en) * 2008-01-16 2009-07-16 Qualcomm Incorporated Methods and apparatus to reduce channel switching time
WO2009092016A1 (en) 2008-01-16 2009-07-23 Qualcomm Incorporated Methods and apparatus to reduce channel switching time

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
"Functional Model of Conditional Access System", EBU Review, Technical European Broadcasting Union, Brussels, BE, n° 266, Dec. 21, 1995.
Francis, Lishoy, William G. Sirett, Keith Mayes, and Konstantinos Markantonakis. "Countermeasures for attacks on satellite tv cards using open receivers." In Conferences in Research and Practice in Information Technology Series, vol. 108, pp. 153-158. 2005. *
Menezes, Vanstone, Oorschot: "Handbook of Applied Cryptography", 1997, CRC Press LLC, USA, XP002591810, p. 547-p. 555.

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10091537B2 (en) 2011-10-31 2018-10-02 Nagravision S.A. Method and multimedia unit for processing a digital broadcast transport stream
US10936701B2 (en) 2016-01-26 2021-03-02 Twentieth Century Fox Film Corporation Method and system for conditional access via license of proprietary functionality

Also Published As

Publication number Publication date
FR2954875A1 (en) 2011-07-01
EP2520042A1 (en) 2012-11-07
US20120290831A1 (en) 2012-11-15
FR2954875B1 (en) 2012-01-27
CN102714593B (en) 2015-09-30
TW201123889A (en) 2011-07-01
EP2520042B1 (en) 2018-09-05
WO2011080150A1 (en) 2011-07-07
PL2520042T4 (en) 2019-02-28
TWI523533B (en) 2016-02-21
ES2703395T3 (en) 2019-03-08
PL2520042T3 (en) 2019-02-28
CN102714593A (en) 2012-10-03

Similar Documents

Publication Publication Date Title
US8615650B2 (en) Control-word deciphering, transmission and reception methods, recording medium and server for these methods
US8831219B2 (en) Method of transmitting an additional piece of data to a reception terminal
US8548167B2 (en) System for traceable decryption of bandwidth-efficient broadcast of encrypted messages and security module revocation method used for securing broadcasted messages
US20060200412A1 (en) System and method for DRM regional and timezone key management
US20110099364A1 (en) Method for accessing services by a user unit
US8996870B2 (en) Method for protecting a recorded multimedia content
CN105491409B (en) Enhance CA system in a kind of digital television system
US8804965B2 (en) Methods for decrypting, transmitting and receiving control words, recording medium and control word server to implement these methods
US9191621B2 (en) System and method to record encrypted content with access conditions
CN103250423B (en) For receiving the method for content of multimedia by control word scrambling and CAPTCHA
US9544276B2 (en) Method for transmitting and receiving a multimedia content
US8885816B2 (en) Method for detecting an illicit use of a security processor
Hou et al. Based on cryptosystem secure communication between set-top box and smart card in DTV broadcasting
EP3259923B1 (en) A system for secure re-distribution of conditional access content within a hospitality network
CN107211176A (en) Method for distributing protected content of multimedia
KR20090070881A (en) Broadcast Processing System and Broadcast Processing Method
US9124770B2 (en) Method and system for prevention of control word sharing
JP4802699B2 (en) Limited reception control method, limited reception control system, and limited reception control apparatus in VOD pre-scramble system
CN101820525A (en) Televiewing control method and device

Legal Events

Date Code Title Description
AS Assignment

Owner name: VIACCESS, FRANCE

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MAGIS, ERWANN;REEL/FRAME:028460/0871

Effective date: 20120607

AS Assignment

Owner name: VIACCESS, FRANCE

Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE ASSIGNMENT RECORDED UNDER THE WRONG APPLICATION NO., US 13/359,661. PLEASE CORRECT THE APPLICATION NUMBER TO READ "13519661" PREVIOUSLY RECORDED ON REEL 028460 FRAME 0871. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT;ASSIGNOR:MAGIS, ERWANN;REEL/FRAME:029572/0270

Effective date: 20120607

STCF Information on status: patent grant

Free format text: PATENTED CASE

FPAY Fee payment

Year of fee payment: 4

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Year of fee payment: 8

FEPP Fee payment procedure

Free format text: MAINTENANCE FEE REMINDER MAILED (ORIGINAL EVENT CODE: REM.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

LAPS Lapse for failure to pay maintenance fees

Free format text: PATENT EXPIRED FOR FAILURE TO PAY MAINTENANCE FEES (ORIGINAL EVENT CODE: EXP.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

STCH Information on status: patent discontinuation

Free format text: PATENT EXPIRED DUE TO NONPAYMENT OF MAINTENANCE FEES UNDER 37 CFR 1.362